WO2017147581A1 - Procédé et dispositif de sécurité de stockage de véhicule - Google Patents

Procédé et dispositif de sécurité de stockage de véhicule Download PDF

Info

Publication number
WO2017147581A1
WO2017147581A1 PCT/US2017/019675 US2017019675W WO2017147581A1 WO 2017147581 A1 WO2017147581 A1 WO 2017147581A1 US 2017019675 W US2017019675 W US 2017019675W WO 2017147581 A1 WO2017147581 A1 WO 2017147581A1
Authority
WO
WIPO (PCT)
Prior art keywords
command
storage device
target
pending
storage
Prior art date
Application number
PCT/US2017/019675
Other languages
English (en)
Inventor
SR. Robert H. THIBADEAU
Original Assignee
Antique Books, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Antique Books, Inc. filed Critical Antique Books, Inc.
Priority to US16/080,107 priority Critical patent/US11074356B2/en
Priority to EP17710648.1A priority patent/EP3420490B1/fr
Publication of WO2017147581A1 publication Critical patent/WO2017147581A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/2053—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where persistent mass storage functionality or persistent mass storage control functionality is redundant
    • G06F11/2094—Redundant storage or storage space
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1408—Protection against unauthorised use of memory or access to memory by using cryptography
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00—Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14—Protection against unauthorised use of memory or access to memory
    • G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
    • G06F12/1466—Key-lock mechanism
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G06F21/80—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in storage media based on magnetic or optical technology, e.g. disks with sectors

Definitions

  • the present disclosure relates to storage security, and more specifically, to maintaining privacy of stored information.
  • NVM Non-Volatile Memory
  • DRAM Dynamic Random-Access Memory
  • a different, but similar type of computational system is in some versions of smart houses or buildings (i.e. smart thermostats, security systems, lighting control systems, multimedia control systems, elevator control systems, door access systems, etc.), but vehicles that exist today and can be anticipated to exist in the future will almost all have these problems of security and privacy for the owner or users.
  • a method of operation of a storage device includes determining if there is at least one pending command. In response to
  • the method includes configuring a next command of the at least one pending command, where configuring the next command includes determining if one or more other storage devices are a target of the next command. If one or more other storage devices are a target of the next command, the method includes determining if there are any remaining targets of the next command and delivering the pending command to a next target of the remaining targets. In this manner, complex storage systems may be kept secure.
  • the method also includes, prior to determining if there are any pending commands, receiving at least one command. In some embodiments, this includes receiving the at least one command from a root node. In some embodiments, this includes receiving the at least one command from another storage device. In some embodiments, the next command is a lock command. In some embodiments, the next command is an unlock command.
  • the unlock command includes a user ID and delivering the pending command to the next target also includes delivering the user ID to the next target.
  • configuring the next command includes unlocking at least a portion of a data storage associated with the storage device and delivering a credential to the next target that was located on the at least a portion of the data storage that was unlocked.
  • the storage device is a self-encrypting drive. In some embodiments, the storage device is included in a vehicle. In some embodiments, the storage device is unlocked with a vehicle key.
  • the storage device is an entire storage drive, a partition of a storage drive, a file, a storage object, or a document.
  • a storage device includes a data storage and circuitry.
  • the circuitry is configured to determine if there is at least one pending command and in response, configure a next command, where configuring the next command includes determining if one or more other storage devices are a target of the next command.
  • the circuitry is also configured to, if one or more other storage devices are a target of the next command, determine if there are any remaining targets of the next command and deliver the pending command to a next target of the remaining targets.
  • a storage device includes a configuration module and a communication module.
  • the configuration module is operative to determine if there is at least one pending command and, in response to determining that there is at least one pending command, configure a next command of the at least one pending command, where configuring the next command includes determining if one or more other storage devices are a target of the next command.
  • the communication module is operative to, if one or more other storage devices are a target of the next command, determine if there are any remaining targets of the next command and, if there are any remaining targets of the next command, deliver the pending command to a next target of the remaining targets.
  • Figure 1 illustrates an example arrangement of components in a vehicle, according to some embodiments of the current disclosure
  • Figure 2 illustrates an example Self-Encrypting Drive (SED), according to some embodiments of the current disclosure
  • Figure 3 illustrates an example waterfall process for sharing
  • FIG. 4 illustrates an example Credential Security Provider (SP), according to some embodiments of the current disclosure
  • Figure 5 illustrates an example process for distributing commands in a network of data stores, according to some embodiments of the current disclosure.
  • NVM Non-Volatile Memory
  • a vehicle can be described as a relatively autonomous computing system which involves many computers and potentially many data stores such as NVM.
  • Figure 1 illustrates an example arrangement of components in a vehicle 100, according to some embodiments of the current disclosure.
  • Figure 1 shows several systems that may contain one or more data stores.
  • Infotainment system 1 10, Front Console system 130, Autonomous Driver Assist System (ADAS) 120, Black Box system 140, and Engine system 150.
  • ADAS Autonomous Driver Assist System
  • Black Box system 140 Black Box system
  • Engine system 150 Engine system
  • These data stores can contain information about the users, including, but not limited to, personal data about the user, conversations that the user may have had with others in the vehicle, data about the interaction and operation of the vehicle, data about the vehicle's location when the user is in the vehicle, etc.
  • Other computing systems inside the vehicle may not have user data, but will have data stores such as NVM for booting routine algorithms such as tire pressure monitors.
  • methods and devices are provided to protect user specialized data.
  • cloud server 160 may be the cloud server associated with one particular data service with the vehicle or may be multiple cloud servers each associated with a different data service.
  • cloud server 160 is associated with a backup service for backing up data on the vehicle systems.
  • cloud server 160 is associated with several data services, one of which may be a music listening service used by passengers of the vehicle, a video watching service used by passengers of the vehicle and the like.
  • Subsystem boot data and non-user data generally needs protection against being replaced with non-authorized instances.
  • methods and devices are concerned with protecting the privacy of the owner and users of the vehicle for user data that may be created during the use of the vehicle.
  • SED 200 includes a System-on-Chip (SoC) 201 including processor 202 (such as an Advanced Reduced Instruction Set Computing Machine (ARM) processor), one or more buses 204, a basic crypto module 206, including both access control 208 and media encryption 210 functions.
  • SoC 201 also includes a drive port management function 212 with a media port 214 for interacting with the media.
  • SED 200 also includes a test port 224 (such as a Joint Test Access Group (JTAG) Port), data port driver logic 220 with a data port 226, and a host port management function 222 and a host port 228.
  • the media includes both metadata 218 and encrypted user data 216.
  • SED 200 also includes external DRAM 230.
  • JTAG Joint Test Access Group
  • the SED 200 may be compliant with the Trusted Computing Group (TCG) specification, including, but not limited to the TCG Storage Workgroup Standards, namely the Core Specification, Opal Storage System Subclass (SSC) Specification, Optical SSC Specification, Enterprise SSC Specification, and Storage Interface Interactions Specification (SI IS) specification. As such, these specifications are hereby incorporated herein.
  • TCG Trusted Computing Group
  • SSC Opal Storage System Subclass
  • Optical SSC Specification Optical SSC Specification
  • Enterprise SSC Specification Enterprise SSC Specification
  • SI IS Storage Interface Interactions Specification
  • the Core describes a number of Security Providers (SPs).
  • SPs Security Providers
  • the SSC specifications select among Core SPs for required elements and manufacturers are free to optionally include other Core SPs or SP configurations.
  • the minimal components will contain an Admin SP and a
  • Cryptographic Locking SP enabled for encrypting ranges of data in the NVM. This is true of all three of the above SSC specifications now in use.
  • a capability is added that would represent a "Vehicular SSC" compatible with the Core Specification but with new, not previously described, features that could be described as a new SSC for the TCG Storage Workgroup Standards.
  • vehicles such as vehicle 100 lend themselves to a single key since generally all the computing systems are turned on and off at the same time.
  • unlock credentials can be employed and distributed in the user data stores of vehicle 100 and employed as fast as needed to switch on the car. Also the credentials need to be controlled to 'turn off a user data store, and also to cryptographically erase a user data store.
  • Cars such as vehicle 100 may generally last years. Now and in the future, it will be commonplace for cars to collect personal data and information on users that can span years. This information can include where the cars have been and what users have said or done inside the cars. This information may then be associates with the identity of the users and their credit cards and health information.
  • User storage needs to be segregated particularly if there is more than one user. User storage may need to be segregated as well from system data and programs. For example, several members of a family may use a vehicle but user storage may be segregated so that only the members who are present in the vehicle (or presently controlling it) have their user data exposed. Similar requirements could be made for multiple drivers/operators of a fleet vehicle. Depending on the current operator, different data stores should be accessible while others should remain inaccessible. Furthermore, as vehicles become more autonomous, it is logical they will have to know who is in the car and what the roles of the people are to know who to listen to and how to understand their directives or questions.
  • vehicles may need secure methods for storing user data in the cloud (e.g., in any suitable remote location such as an internet service, corporate network, a family computer, or perhaps a user's mobile device) in such a fashion that storage needs to be safe from theft or prying eyes.
  • user/Owner privacy is tantamount and may be additionally insured for premium payments of a vehicle which may cover the small additional cost of self-encrypting drive technology.
  • one of the improvements over the existing TCG specifications is to provide a means of moving and storing encrypted data directly to the cloud without the possibility of theft or prying eyes by unauthorized users. Furthermore, in some embodiments, this encrypted user data needs to be able to be installed on a new replacement vehicle. For example, in a fleet, a user needs to be able to go to an assigned vehicle with the user's private user data following the user through the cloud.
  • Embodiments described herein may provide one or more of the following improvements:
  • one or more of these improvements are accomplished by using SED Waterfalls for Unlocking Key Management.
  • the basic improvement is to waterfall from a SED such as SED 200 that has a credential locking range to generate credentials to unlock locking ranges on other SEDs.
  • waterfalls refers to the successful unlocking of one SED 200 enabling the successful unlocking of one or more additional SEDs 200.
  • the SED itself recognizes a "Credential
  • Waterf ailing SP that applies to a specific range containing the Credential Waterf ailing SP data specific to the vehicle 100.
  • more than one SED can contain a replica of the root credential range for particular users that are authorized to start the car.
  • the credential range that permits a subset of users/owners to cryptographically erase all user data could be separate or part of the same credential range. Similar mechanisms can be used for users that are able to cause backup or restore operations of user data.
  • the waterfall has to carry the user ID and the credentials needed to unlock other ranges (e.g., user data) on the same SED or on other SEDs downstream from the root.
  • other ranges e.g., user data
  • FIG. 3 and 4 shows the "vehicle key" as capable of instigating a waterfall process through SEDs throughout the vehicle.
  • the vehicular key activates a process in two or more redundant root SEDs labeled as SEDs A. Any SED with the vehicular capability can be in any position in this waterfall process.
  • the waterfall itself is determined entirely by how the SEDs are setup. This is a modular approach, meaning that if any one particular SED in the waterfall fails for any reason (such as a computer failure or a failure to unlock), the failure does not prevent the unlocking of downstream SEDs. In this respect, if one SED fails, the user is still able to start and use the car to the extent that that car component failure otherwise is not critical to otherwise starting and using the car.
  • the privacy preservation system must not impact vehicle reliability and safety.
  • node A3 has the ability to unlock nodes B5 through B9. This relationship can be thought of as a parent node being able to unlock a child node. However, it should also be noted that these nodes may have more than one parent.
  • node B5 can be unlocked by either A3 or A4 in the arrangement shown in Figure 3. In general, this process applies to any heterarchical acyclic directed graph of storage/compute nodes. Also, while Figure 3 only shows arrangements where all parents of a child are on the same level or rank, this is not required. In a heterarchy, the nodes possess the potential to be ranked a number of different ways. In general, this means that a node may have more than one parent. For instance, node C4 could be unlocked by A3 in addition to nodes B8 and B9 in some examples.
  • the Core Specification provides for a number of SPs.
  • one Admin SP and one Locking SP are defined for all the SSCs published and approved by the TCG SWG.
  • a new SP is defined. This is called the "Credential SP”. It is defined as follows:
  • the Credential SP Like every SP, it has certain tables such as an Authority Table, a Crypto Table, etc. already defined in the Core Specification. But the Credential SP also contains a unique table called the "Credential Table". It is defined by its columns. This table has as many rows as needed for the downward waterfall (the number of SEDs below a given SED). The columns of the table constitute the control data required to be communicated under the Credential SP special actions also listed below.
  • Figure 4 illustrates some aspects of the Credential SP.
  • the vehicle key is the Root Credential SP.
  • Target Name the name, or index, into the row of the Credential Table Target Locking SP Location: which SED and which Locking SP in it is the target.
  • Target Authority Authentication which Authority in the Locking SP is to be used to authenticate to that Locking SP.
  • Locking SP has the KEK to be used to provide the derivation function for the Media Encryption key.
  • Target Locking SP Range which Range defined in the target Locking SP is to be manipulated.
  • the commands unique to this Credential SP are as follows:
  • LockDownstream This creates a command with the row of the table to have the Targeted Locking SP lock the specified range for reading and writing.
  • UnLockDownstream(Target Name) This creates a command with the row of the table to have the Targeted Locking SP unlock the specified range for reading and writing.
  • EraseDownstream This creates a command with the row of the table to have the Targeted Locking SP cryptographically erase the specified range.
  • RestoreDownStream (Target Name, LockingSP-Settings, Start/Stop) This is the inverse of BackupDownstream and restores a Locking range. Start and Stop indicate that the user data being written is encrypted (after Start) or is now just plaintext (after Stop). [0050] Another benefit of the system is that it allows for easy changes in encryption policies. That is, if laws change and/or policies of the car
  • the system permits the easy migration of the data using the waterfall approach with data ranges.
  • any node such as SED 200 will determine if there are any pending commands (step 402). If there are no pending commands (decision 403), the process ends, or waits until there is a pending command. If there are pending commands (decision 405), the node will configure the next command (step 404). In some embodiments, this corresponds to performing the command on itself, and in some embodiments this involves determining if any other nodes should be the targets of this command. For example, if the A3 node in Figure 3 receives an UnLockDownstream command, it may also propagate this command to nodes B5 through B9.
  • the node determines if there are any remaining targets (step 406). If there are not (decision 407), then the process returns to step 402 to determine if there are any more pending commands. If there are targets remaining (decision 409), then the node delivers the pending command to the next target (step 408) and proceeds to step 406 to determine if there are any remaining targets. In this way, changes in the system can be propagated or waterfall from one root node (potentially more than one) to multiple other nodes (potentially all nodes).
  • the normal read/write operations are used on the storage device.
  • the actual encryption performed by the SED is industry standard as defined in the Locking SPs. In these
  • the KEKs need to be hidden and known only to the Locking SPs.
  • the Authentication Authority should be a public key authority, preferably Elliptic Curve.
  • Elliptic Curve cryptography is an approach to public-key cryptography based on the algebraic structure of elliptic curves. In some embodiments, Elliptic Curve requires smaller keys compared to cryptography systems.
  • the private keys are known by the LockingSPs. There should be one or more mechanisms in the Admin SP on the SEDs for manufacturer approved secure transmission of the root public- private key pairs needed to derive the KEKs and verify the Authentications.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Quality & Reliability (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Lock And Its Accessories (AREA)

Abstract

L'invention concerne des procédés et des dispositifs de sécurité de stockage de véhicule. Dans certains modes de réalisation, un procédé de fonctionnement d'un dispositif de stockage consiste à déterminer s'il existe au moins une commande en attente. En réponse à la détermination du fait qu'il existe au moins une commande en attente, le procédé consiste à configurer une commande suivante de ladite commande en attente, la configuration de la commande suivante consistant à déterminer si un ou plusieurs autres dispositifs de stockage sont une cible de la commande suivante. Si un ou plusieurs autres dispositifs de stockage sont une cible de la commande suivante, le procédé consiste à déterminer s'il existe des cibles restantes de la commande suivante et délivrer la commande en attente à une cible suivante des cibles restantes. De cette manière, des systèmes de stockage complexes peuvent être maintenus sécurisés.
PCT/US2017/019675 2016-02-26 2017-02-27 Procédé et dispositif de sécurité de stockage de véhicule WO2017147581A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US16/080,107 US11074356B2 (en) 2016-02-26 2017-02-27 Method and device for vehicular storage security
EP17710648.1A EP3420490B1 (fr) 2016-02-26 2017-02-27 Procédé et dispositif de sécurité de stockage de véhicule

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US201662300577P 2016-02-26 2016-02-26
US62/300,577 2016-02-26

Publications (1)

Publication Number Publication Date
WO2017147581A1 true WO2017147581A1 (fr) 2017-08-31

Family

ID=58267178

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2017/019675 WO2017147581A1 (fr) 2016-02-26 2017-02-27 Procédé et dispositif de sécurité de stockage de véhicule

Country Status (3)

Country Link
US (1) US11074356B2 (fr)
EP (1) EP3420490B1 (fr)
WO (1) WO2017147581A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11329814B2 (en) * 2018-12-10 2022-05-10 Marvell Asia Pte, Ltd. Self-encryption drive (SED)
CN114594912A (zh) * 2022-03-14 2022-06-07 中国第一汽车股份有限公司 一种车辆仪表系统的信息保护方法、装置、设备及介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110307709A1 (en) * 2010-06-14 2011-12-15 Seagate Technology Llc Managing security operating modes
US20150121134A1 (en) * 2013-10-31 2015-04-30 Fusion-Io, Inc. Storage device failover

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8798852B1 (en) * 2013-03-14 2014-08-05 Gogoro, Inc. Apparatus, system, and method for authentication of vehicular components
US9871787B2 (en) * 2016-02-23 2018-01-16 Assured Information Security, Inc. Authentication processing for a plurality of self-encrypting storage devices

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110307709A1 (en) * 2010-06-14 2011-12-15 Seagate Technology Llc Managing security operating modes
US20150121134A1 (en) * 2013-10-31 2015-04-30 Fusion-Io, Inc. Storage device failover

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
TRUSTED COMPUTING GROUP: "TCG TCG Storage Architecture Core Specification - Specification Version 2.01", 5 August 2015 (2015-08-05), XP055369162, Retrieved from the Internet <URL:https://trustedcomputinggroup.org/wp-content/uploads/TCG_Storage_Architecture_Core_Spec_v2.01_r1.00.pdf> [retrieved on 20170503] *

Also Published As

Publication number Publication date
US20190065769A1 (en) 2019-02-28
EP3420490B1 (fr) 2021-09-29
US11074356B2 (en) 2021-07-27
EP3420490A1 (fr) 2019-01-02

Similar Documents

Publication Publication Date Title
US11463246B2 (en) Vehicle access systems and methods
US8103883B2 (en) Method and apparatus for enforcing use of danbury key management services for software applied full volume encryption
US20080181406A1 (en) System and Method of Storage Device Data Encryption and Data Access Via a Hardware Key
US20090046858A1 (en) System and Method of Data Encryption and Data Access of a Set of Storage Devices via a Hardware Key
EP1953670A2 (fr) Système et procédé de cryptage de données d&#39;un dispositif de stockage et accès aux données
CN102084373A (zh) 备份存储在安全存储设备中的数字内容
KR20100133953A (ko) 데이터를 안전하게 하는 시스템 및 방법
EP1953668A2 (fr) Système et procédé de cryptage de données et accès aux données d&#39;un ensemble de dispositifs de stockage via une clé matérielle
CN104361291B (zh) 数据处理方法和装置
WO2011148224A1 (fr) Procédé et système d&#39;environnement informatique sécurisé à commande vérifiable de mouvement de données
US11074356B2 (en) Method and device for vehicular storage security
WO2016179590A1 (fr) Procédé d&#39;authentification, de contrôle d&#39;accès et de confirmation délégués de commandes irréversibles dans un dispositif de stockage
US11601285B2 (en) Securely authorizing service level access to a backup system using a specialized access key
CN112084468B (zh) 一种多软件授权验证方法
US20130064366A1 (en) Method for Generating Cryptographic Half-Keys, and Associated System
KR101387939B1 (ko) 백업용 스토리지 제어 시스템
CN103198029B (zh) 具有防护机制的随身碟和数据储存系统
CN115310060A (zh) 一种计算机的加解密方法及系统

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017710648

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017710648

Country of ref document: EP

Effective date: 20180926

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17710648

Country of ref document: EP

Kind code of ref document: A1